Refactor user agent validator

psalm-baseline.xml

@@ -241,16 +241,9 @@
     <MissingReturnType>
       <code><![CDATA[initializeValidatorChain]]></code>
     </MissingReturnType>
-    <MixedArgument>
-      <code><![CDATA[$validator]]></code>
-    </MixedArgument>
     <MixedAssignment>
-      <code><![CDATA[$validator]]></code>
       <code><![CDATA[$validatorValues]]></code>
     </MixedAssignment>
-    <MixedMethodCall>
-      <code><![CDATA[new $validator(null)]]></code>
-    </MixedMethodCall>
     <MoreSpecificImplementedParamType>
       <code><![CDATA[$id]]></code>
     </MoreSpecificImplementedParamType>
@@ -445,24 +438,10 @@
       <code><![CDATA[static]]></code>
     </PossiblyUnusedReturnValue>
   </file>
-  <file src="src/Validator/HttpUserAgent.php">
-    <PossiblyNullPropertyAssignmentValue>
-      <code><![CDATA[$data]]></code>
-    </PossiblyNullPropertyAssignmentValue>
-  </file>
   <file src="src/ValidatorChain.php">
     <MixedArgumentTypeCoercion>
       <code><![CDATA[$callback]]></code>
     </MixedArgumentTypeCoercion>
-    <MixedAssignment>
-      <code><![CDATA[$data]]></code>
-      <code><![CDATA[$data]]></code>
-      <code><![CDATA[$validator]]></code>
-      <code><![CDATA[$validators]]></code>
-    </MixedAssignment>
-    <MixedMethodCall>
-      <code><![CDATA[new $validator($data)]]></code>
-    </MixedMethodCall>
     <PossiblyUnusedReturnValue>
       <code><![CDATA[callable]]></code>
     </PossiblyUnusedReturnValue>
@@ -815,6 +794,7 @@
       <code><![CDATA[$_SESSION[$key]]]></code>
       <code><![CDATA[$_SESSION[$key]]]></code>
       <code><![CDATA[$_SESSION['__Laminas']['_VALID']]]></code>
+      <code><![CDATA[$_SESSION['__Laminas']['environment']]]></code>
     </MixedArrayAccess>
     <MixedAssignment>
       <code><![CDATA[$header]]></code>
@@ -879,6 +859,9 @@
     </MixedArrayAccess>
   </file>
   <file src="test/TestAsset/TestFailingValidator.php">
+    <PossiblyUnusedProperty>
+      <code><![CDATA[$current]]></code>
+    </PossiblyUnusedProperty>
     <PossiblyUnusedReturnValue>
       <code><![CDATA[bool]]></code>
     </PossiblyUnusedReturnValue>
@@ -927,21 +910,6 @@
       <code><![CDATA[gc]]></code>
     </PossiblyUnusedMethod>
   </file>
-  <file src="test/TestAsset/TestSaveHandlerWithValidator.php">
-    <ImplementedParamTypeMismatch>
-      <code><![CDATA[$data]]></code>
-    </ImplementedParamTypeMismatch>
-    <ImplementedReturnTypeMismatch>
-      <code><![CDATA[bool]]></code>
-    </ImplementedReturnTypeMismatch>
-    <ParamNameMismatch>
-      <code><![CDATA[$maxlifetime]]></code>
-    </ParamNameMismatch>
-    <PossiblyUnusedMethod>
-      <code><![CDATA[close]]></code>
-      <code><![CDATA[gc]]></code>
-    </PossiblyUnusedMethod>
-  </file>
   <file src="test/TestAsset/TestSimpleCacheAdapter.php">
     <MixedAssignment>
       <code><![CDATA[$result]]></code>

src/SessionManager.php

@@ -6,15 +6,20 @@
 
 use Laminas\EventManager\Event;
 use Laminas\EventManager\EventManagerInterface;
+use Laminas\Session\Validator\Environment;
+use Laminas\Session\Validator\ValidatorInterface;
 use Traversable;
 
 use function array_key_exists;
 use function array_merge;
+use function assert;
 use function headers_sent;
 use function is_array;
+use function is_string;
 use function iterator_to_array;
 use function preg_match;
 use function register_shutdown_function;
+use function serialize;
 use function session_destroy;
 use function session_id;
 use function session_name;
@@ -24,6 +29,7 @@
 use function session_status;
 use function session_write_close;
 use function setcookie;
+use function unserialize;
 
 use const PHP_SESSION_ACTIVE;
 
@@ -60,6 +66,8 @@ class SessionManager extends AbstractManager
     /** @var EventManagerInterface Validation chain to determine if session is valid */
     protected $validatorChain;
 
+    protected array $options = [];
+
     /**
      * Constructor
      *
@@ -77,6 +85,8 @@ public function __construct(
             $validators = array_merge($this->defaultValidators, $validators);
         }
 
+        $this->options = $options;
+
         parent::__construct($config, $storage, $saveHandler, $validators);
         register_shutdown_function([$this, 'writeClose']);
     }
@@ -160,16 +170,32 @@ public function start($preserveStorage = false)
      */
     protected function initializeValidatorChain()
     {
-        $validatorChain  = $this->getValidatorChain();
-        $validatorValues = $this->getStorage()->getMetadata('_VALID');
-
-        foreach ($this->validators as $validator) {
-            // Ignore validators which are already present in Storage
-            if (is_array($validatorValues) && array_key_exists($validator, $validatorValues)) {
+        /** @var array<string, mixed> $storage */
+        $storage = $this->getStorage()->getMetadata();
+
+        /**
+         * @var class-string<ValidatorInterface> $validatorName
+         */
+        foreach ($this->validators as $validatorName) {
+            $validatorValues = $this->getStorage()->getMetadata('_VALID');
+            if (is_array($validatorValues) && array_key_exists($validatorName, $validatorValues)) {
                 continue;
             }
 
-            $validator = new $validator(null);
+            if (isset($storage['environment'])) {
+                assert(is_string($storage['environment']));
+                /** @var Environment $initialEnvironment */
+                $initialEnvironment = unserialize($storage['environment']);
+            } else {
+                $initialEnvironment = Environment::fromGlobals($_SERVER);
+                $this->getStorage()->setMetadata('environment', serialize($initialEnvironment));
+            }
+
+            $currentEnvironment = Environment::fromGlobals($_SERVER);
+
+            $validatorChain = $this->getValidatorChain();
+            $validator      = new $validatorName($initialEnvironment, $currentEnvironment, $this->options);
+
             $validatorChain->attach('session.validate', [$validator, 'isValid']);
         }
     }
@@ -399,8 +425,7 @@ public function getValidatorChain()
     public function isValid()
     {
         $validator = $this->getValidatorChain();
-
-        $event = new Event();
+        $event     = new Event();
         $event->setName('session.validate');
         $event->setTarget($this);
         $event->setParams($this);

src/Validator/Environment.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Laminas\Session\Validator;
+
+use function is_string;
+use function session_id;
+
+final class Environment
+{
+    public function __construct(
+        public readonly ?string $userAgent = null,
+        public readonly ?string $remoteAddr = null,
+        public readonly ?string $forwardedFor = null,
+        public readonly ?string $sessionId = null
+    ) {
+    }
+
+    public static function fromGlobals(array $server): self
+    {
+        $userAgent = isset($server['HTTP_USER_AGENT']) && is_string($server['HTTP_USER_AGENT'])
+            ? $server['HTTP_USER_AGENT']
+            : null;
+
+        $remoteAddr = isset($server['REMOTE_ADDR']) && is_string($server['REMOTE_ADDR'])
+            ? $server['REMOTE_ADDR']
+            : null;
+
+        $forwardedFor = isset($server['HTTP_X_FORWARDED_FOR']) && is_string($server['HTTP_X_FORWARDED_FOR'])
+            ? $server['HTTP_X_FORWARDED_FOR']
+            : null;
+
+        $sessionId = session_id();
+
+        return new self($userAgent, $remoteAddr, $forwardedFor, $sessionId);
+    }
+}

src/Validator/HttpUserAgent.php

@@ -4,30 +4,17 @@
 
 namespace Laminas\Session\Validator;
 
-/**
- * @implements ValidatorInterface<string>
- */
-class HttpUserAgent implements ValidatorInterface
+final class HttpUserAgent implements ValidatorInterface
 {
-    /**
-     * Internal data
-     *
-     * @var string
-     */
-    protected $data;
-
     /**
      * Constructor
      * get the current user agent and store it in the session as 'valid data'
-     *
-     * @param string|null $data
      */
-    public function __construct($data = null)
-    {
-        if ($data === null || $data === '') {
-            $data = $_SERVER['HTTP_USER_AGENT'] ?? null;
-        }
-        $this->data = $data;
+    public function __construct(
+        public readonly Environment $initial,
+        public readonly Environment $current,
+        array $option = []
+    ) {
     }
 
     /**
@@ -36,17 +23,7 @@ public function __construct($data = null)
      */
     public function isValid(): bool
     {
-        $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? null;
-
-        return $userAgent === $this->getData();
-    }
-
-    /**
-     * Retrieve token for validating call
-     */
-    public function getData(): mixed
-    {
-        return $this->data;
+        return $this->initial->userAgent === $this->current->userAgent;
     }
 
     /**

src/Validator/Id.php

@@ -7,16 +7,13 @@
 use function ini_get;
 use function is_numeric;
 use function preg_match;
-use function session_id;
 use function trigger_error;
 
 use const E_USER_DEPRECATED;
 use const PHP_VERSION_ID;
 
 /**
  * session_id validator
- *
- * @implements ValidatorInterface<string|null>
  */
 final class Id implements ValidatorInterface
 {
@@ -26,13 +23,11 @@ final class Id implements ValidatorInterface
      * Allows passing the current session_id; if none provided, uses the PHP
      * session_id() function to retrieve it.
      */
-    public function __construct(protected ?string $id = null)
-    {
-        if ($id === null || $id === '') {
-            $id = session_id();
-        }
-
-        $this->id = $id;
+    public function __construct(
+        public readonly Environment $initial,
+        public readonly Environment $current,
+        array $options = []
+    ) {
     }
 
     /**
@@ -42,9 +37,7 @@ public function __construct(protected ?string $id = null)
      */
     public function isValid(): bool
     {
-        $id = $this->id;
-
-        if ($id === null) {
+        if ($this->current->sessionId === null) {
             return false;
         }
 
@@ -64,15 +57,7 @@ public function isValid(): bool
             default => '#^[0-9a-v]*$#',
         };
 
-        return (bool) preg_match($pattern, $id);
-    }
-
-    /**
-     * Retrieve token for validating call (session_id)
-     */
-    public function getData(): ?string
-    {
-        return $this->id;
+        return (bool) preg_match($pattern, $this->current->sessionId);
     }
 
     /**